# AI Risk/Use Heatmap Template

Purpose: make current AI usage visible and prioritize board/executive attention.

How to use:
1. List material AI use cases.
2. Score each use case for business value and risk exposure (1-5).
3. Prioritize items in the high-value/high-risk quadrant for governance action.

Scales:
- Value: `1 = low impact` to `5 = high strategic/financial impact`
- Risk: `1 = low exposure` to `5 = high exposure`

## Heatmap Table

| Use Case ID | Business Function | Use Case Description | Owner | Value (1-5) | Risk (1-5) | Risk Type (Data/Model/Operational/Reputational) | Current Control Status | Priority Action |
|---|---|---|---|---:|---:|---|---|---|
| AI-01 |  |  |  |  |  |  |  |  |
| AI-02 |  |  |  |  |  |  |  |  |
| AI-03 |  |  |  |  |  |  |  |  |
| AI-04 |  |  |  |  |  |  |  |  |
| AI-05 |  |  |  |  |  |  |  |  |

## Priority Rules
- **High Value / High Risk (V>=4, R>=4):** board-visible governance required
- **High Value / Lower Risk (V>=4, R<=3):** accelerate with standard controls
- **Lower Value / High Risk (V<=3, R>=4):** contain, redesign, or pause
- **Lower Value / Lower Risk (V<=3, R<=3):** monitor and review periodically

## Board Discussion Prompts
1. Which use cases are creating meaningful value today?
2. Where is risk control weakest relative to business impact?
3. Which use cases require immediate executive accountability reset?
4. What should be paused until controls mature?